Grsecurity restrictions

Some restrictions will be applied when using a grsecurity kernel (Alpine Linux default kernel).
The most notable is the use of lxc-attach which will not be allowed because of GRKERNSEC_CHROOT_CAPS.
To solve this we will have to disable this grsec restriction by creating a sysctl profile for lxc.
Create the following file /etc/sysctl.d/10-lxc.conf and add:

kernel.grsecurity.chroot_caps = 0

There are a few other restrictions that can prevent proper container functionality.
When things do not work as expected always check the kernel log with dmesg to see if grsec prevented things from happening.

Connecting to the guest

By default sshd is not installed, so you will have to attach to the container or connect to the virtual console. This is done with:

Attach to container

lxc-attach -n guest1

Just type exit to detach the container again (please do check the grsec notes above)

Connect to virtual console

lxc-console -n guest1

To disconnect from it, press Ctrl+aq

Deleting a guest

Make sure the guest is stopped and run:

lxc-destroy -n guest1

This will erase everything, without asking any questions. It is equivalent to:

rm -r /var/lib/lxc/guest1

Advanced

Creating a LXC container without modifying your network interfaces

The problem with bridging is that the interface you bridge gets replaced with your new bridge interface.
That is to say that say you have an interface eth0 that you want to bridge, your eth0 interface gets replaced with the br0 interface that you create. It also means that the interface you use needs to be placed into promiscuous mode to catch all the traffic that could de destined to the other side of the bridge, which again may not be what you want.

The solution is to create a dummy network interface, bridge that, and set up NAT so that traffic out of your bridge interface gets pushed through the interface of your choice.

So, first, lets create that dummy interface (thanks to ncopa for talking me out of macvlan and pointing out the dummy interface kernel module)

modprobe dummy

This will create a dummy interface called dummy0 on your host.

Now we will create a bridge called br0

brctl addbr br0
brctl setfd br0 0

and then make that dummy interface one end of the bridge

brctl addif br0 dummy0

Next, let's give that bridged interface a reason to exists

ifconfig br0 192.168.1.1 netmask 255.255.255.0 up

Create a file for your container, let's say /etc/lxc/bridgenat.conf, with the following settings.

Now you should be able to route through your bridge interface to the internet facing interface of your host from your container, just like at home!

You could also have a dhcp server running on your host, and set it up to give IP addresses from your private subnet to any container that requests it, and then have one template for multiple alpine LXC containers, perfect for alpine development :)

Using static IP

If you're using static IP, you need to configure this properly on guest's /etc/network/interfaces. To stay on the above example, modify /var/lib/lxc/guest1/rootfs/etc/network/interfaces